Ukungeza i-subnet yesibili ku-VPN phakathi kwezindawo: izindlela ezimbili
Ama-tunnel asuselwa kunqubomgomo adinga izikhethi ezihambisanayo nhlangothi zombili; lawo asuselwa emzileni adinga umzila. Khetha indlela efanele bese ulungisa umzila wokubuya kuqala.
Ukungeza i-subnet yesibili ku-tunnel esebenzayo phakathi kwezindawo kuthatha amaminithi amahlanu kwesinye isakhiwo kanye nantambama yonke kwesinye. Uma i-tunnel ifaka imizila yamaprefix oyishoyo, ungeza umzila futhi ithrafikhi iwulandela. Uma ixoxisana ngephere lesikhethi elilodwa elingaguquki, iprefix elisha lihlala lingavikelwe kuze kuvumelane nhlangothi zombili ngephere elihambisanayo. Izinto ezintathu zinquma: lokho okuchazwa ngokweqiniso ukucushwa kwesinye ngesinye isici, ukuthi ithrafikhi okuxoxiswane ngayo iyancipha yini ibe yiphere elincane elihambisanayo, nokuthi umzila wokubuya wohlu olusha ungokabani.
Funda i-kernel, hhayi ilebula lesimo
I-tunnel ebika ukuxhumana ifake okungenani inhlangano yengane eyodwa, kodwa hhayi ngempela leyo oyicabangayo. Ku-Linux i-kernel ikhombisa okusetshenziswayo: ip xfrm policy ibala amaphere ezikhethi futhi swanctl --list-sas (noma ipsec statusall elidala) likhombisa lokho izinhlangothi ezakuvumelana, kufaka izikhethi zethrafikhi ohlangothini ngalunye. Uma iprefix elisha lingekho kukho kokubili, alivikelwe, noma yini eshiwo yifayela lokucushwa.
Qhathanisa lokhu nethebula yemizila. Ekwakhiweni okususelwa emzileni idivayisi ye-tunnel iyisinyathelo esilandelayo samaprefix avikelwe. Ukwakhiwa okususelwa kunqubomgomo ngokuvamile akunawo umzila othile we-subnet ekude, kunomzila ozenzakalelayo kuphela, ngoba umzila unqunywa inqubomgomo hhayi ithebula.
Kususelwa kunqubomgomo: izinhlangothi zombili kufanele zibale iprefix elisha
Ngamagama e-strongSwan isikhethi sihlala ku-local_ts naku-remote_ts ngaphansi kokucushwa kwengane, izindlalifa zika-leftsubnet no-rightsubnet. Iprefix elisha kufanele livele nhlangothi zombili njengesibuko: lokho isiza A elikubiza ngokwasekhaya isiza B likubiza ngokukude. Ukungafani akuvamisile ukunikeza iphutha elicacile. Izinhlangothi ziyancipha zifinyelele ekuhlanganyeleni, iprefix elidala liyaqhubeka lisebenza futhi elisha kuphela elihlulekayo buthule.
swanctl --load-conns
swanctl --initiate --child <child-name>
swanctl --list-sas
ip xfrm policyKu-pfSense noma ku-OPNsense lokho kusho ingxenye yesibili ye-Phase 2 ehlanganisa i-subnet yasekhaya entsha ne-subnet ekude entsha, bese kusetshenziswa. Gcina ingxenye endala; ukuyishintsha kuhambisa i-subnet yokuqala esikhundleni sokuyengeza. Uma i-Phase 2 ekhona isivele ihlanganisa i-supernet efana ne-0.0.0.0/0 noma ibanga elifingqiwe, ungangezi ingxenye encane eceleni kwayo: izikhethi ezigqagqene zifaka izinqubomgomo eziqhudelanayo futhi ukulandelana kokuhlola kunquma owinile.
I-IKEv1 yenza iphere ngalinye le-subnet libe yi-Phase 2 yalo, futhi uhlangothi olwamukela iphere elilodwa ngokushintshana lulahla okunye. I-IKEv2 ingathwala amaphere amaningi ezikhethi kuingane eyodwa, kodwa kuphela uma zombili izinhlelo zokwenziwa ziwamukela. Uhlu oluvela ku-swanctl --list-sas luyiqiniso; okubhalile isicelo.
Kususelwa emzileni: umzila uyinqubomgomo
Isixhumanisi se-XFRM noma idivayisi ye-VTI ithwala ithrafikhi ngokuvumelana nethebula yemizila. Ukhomba iprefix elisha kudivayisi kuzo zombili izindawo, futhi isimo esiboshelwe ekuguqulweni kwesixhumanisi siyasebenza. Akukho phere lezikhethi okufanele lihambisane, yingakho lo mklamo ukhula kangcono njengoba ama-subnet anda. Umhlahlandlela we-strongSwan wokudlulisa uxoxa kabanzi ngohlangothi lwe-kernel.
ip route add 192.168.60.0/24 dev xfrm0
ip route get 192.168.60.10I-WireGuard iya phambili. AllowedIPs inguhlu lwezimvume ze-crypto ngesikhathi esisodwa futhi, nge-wg-quick, ingumbhalo wokuthebula yemizila. Engeza iprefix ohlangothini olulodwa kuphela bese uthola ukuxhawula, amaphakethe aphumayo nokuthula, ngoba uhlangothi olukude lulahla amaphakethe omthombo wawo ongekho ohlwini lwalo. Ifomu wg set lishintsha lonke uhlu, ngakho phinda amaprefix ayekade esebenza noma uzobe uwagunda:
wg set wg0 peer <PUBKEY> allowed-ips 192.168.10.0/24,192.168.60.0/24
ip route add 192.168.60.0/24 dev wg0Umyalo wesibili awusona isinqumo uma usebenzise wg set esikhundleni sika-wg-quick. I-kernel yamukela uhlu olusha ngokushesha, kodwa akukho okungeza umzila walo, ngakho ithrafikhi eyenziwe endaweni isaphuma ngesango elizenzakalelayo. Lesi yisizathu esivame kakhulu sokuthi i-subnet entsha ye-WireGuard isebenze isuka kumsingathi we-tunnel hhayi kwi-laptop.
Umzila wokubuya wehluleka kaningi kune-tunnel
Abasingathi ku-subnet ekude entsha kufanele bathumele izimpendulo zibuyele emuva ngesango le-VPN. Uma lelo sango kungeyona i-router yabo ezenzakalelayo impendulo iya ku-router ye-LAN, eyilahla noma eyidlulisela ku-inthanethi ngekheli lomthombo eliyimfihlo. Hlola kumsingathi ohlangothini olukude hhayi esangweni: ip route get 10.30.20.15 ku-Linux noma Find-NetRoute -RemoteIPAddress 10.30.20.15 ku-PowerShell likhombisa isinyathelo esilandelayo umsingathi azosisebenzisa ngempela. Uma impendulo kungeyona indawo yokugcina ye-tunnel, engeza umzila oqinile weprefix elisha lapho.
I-NAT yomthombo esizeni esingenalo umzila wokubuya iyindlela esemthethweni futhi iyindlela izinto eziningi ze-hub-and-spoke ezigwema ngayo ukuthinta iseva ngayinye. Yisebenzise futhi ku-prefix elisha esangweni sohlangothi lokuphela:
iptables -t nat -A POSTROUTING -s 10.30.20.0/24 -d 192.168.60.0/24 -j MASQUERADEIzindleko zangempela. Amalogi akude ayeka ukukhombisa amakheli omthombo ngamanye, futhi imithetho ye-firewall encike ku-subnet yokuqala ihlangana ibe umthetho owodwa wesango. Khetha lokho ngamabomu, hhayi ngoba umzila wawungekho.
Ama-firewall ayingxenye yesibili yomzila wokubuya. Amadivayisi asuselwa ezigabeni awandisi ngokuzenzakalela isigaba sesixhumanisi se-tunnel esikhona ku-subnet entsha, futhi umthetho obhalelwe iprefix elidala awuzoqondana. Engeza i-subnet entsha esigabeni noma kuphere lwemithetho kuzo zombili izinhlangothi ngaphambi kokusola i-IPsec.
Nquma ngemibuzo emithathu, bese uqinisekisa ngethrafikhi
Inguqulo emfushane: ingabe ukucushwa kohlangothi kubala amaprefix (kususelwa kunqubomgomo), noma ithrafikhi iqondiswa kwisixhumanisi (kususelwa emzileni)? Ingabe zombili iziphetho zibala iprefix elisha? Ingabe ikhona indlela yokubuya isuka ku-subnet entsha iya ebangeni lomthombo lokuqala?
| Tunnel style | Where the prefix goes | What breaks if you skip it |
|---|---|---|
| Policy-based IPsec | Selector pair on both peers | Old subnets work, the new one fails with no clear error |
| Route-based XFRM or VTI | Route into the device on both sites | Packets routed but not transformed, or the state never matches |
| WireGuard | AllowedIPs on both peers plus a route | Handshake succeeds, replies are dropped |
| Overlapping supernet | Adjust the existing entry instead | A shadowed policy wins or loses by evaluation order |
Ukuqinisekisa yindawo lapho izinguquko eziningi zivalwa khona ngokushesha kakhulu. I-ping esuka esangweni ifakazela okuncane, ngoba isango lithumela lisuka kulo futhi ngokuvamile lihambisana nenqubomgomo ehlukile kuneyomsingathi. Pinga kumsingathi ku-subnet entsha, bese ugijima uhlelo olwadala ushintsho, futhi bheka izibali hhayi isithonjana sesimo.
tcpdump -ni any host 192.168.60.10 and (esp or udp port 4500)
ip xfrm state
wg showKu-tunnel esuselwa kunqubomgomo izibali ze-ip xfrm state kufanele zikhuphuke nhlangothi zombili; izibali eziyisicaba zisho ukuthi iphakethe liqondisiwe kodwa alikhethiwe. Ku-WireGuard wg show libika ukudluliswa ohlangothini ngalunye, futhi ukuxhawula okungenawo amabhayithi amukelwe kukhombisa uhlu lohlangothi olukude noma umzila walo wokubuya.
Qeda ngokurekhoda iprefix, isikhethi noma umzila wohlangothi, isinqumo somzila wokubuya kanye nengxenye ye-firewall kanye nayo yonke imininingwane ye-tunnel. Bese uqalisa kabusha isango elilodwa futhi uhlole futhi: umzila owengezwe ngesandla uyanyamalala, futhi umuntu olandelayo akufanele awuthole futhi.